General

  • Target

    cb0aac80ab9c3eb07a99448d7eb898a30ddae2f13809e93d088d0ec57581fff1

  • Size

    496KB

  • Sample

    240317-abj6wahg2t

  • MD5

    c3d0753aa18ae395ae312bedf3390f90

  • SHA1

    94d86e9c0bc3e28ac18625df07484ab13c44338e

  • SHA256

    cb0aac80ab9c3eb07a99448d7eb898a30ddae2f13809e93d088d0ec57581fff1

  • SHA512

    d7d2bcca9ba04913f802c7f75b2314bfb0ed4e2250b08b4e5fbdd8e9ec673a260ca31d4a0953f92dfa20871ef1ecee0be4f17084e7b6a792f792edf54710c2c7

  • SSDEEP

    6144:/pe63b5W9ALT/5+VxdMEW4UCXSGFHSrV2D6kWPzn8ROYrh7QIWU9iQGTuF4:Re6LsScVnMX4UCBFHFD6kWPz8RHQul2

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

216.10.40.16:80

91.121.54.71:8080

209.236.123.42:8080

77.55.211.77:8080

85.105.140.135:443

138.97.60.141:7080

217.13.106.14:8080

190.2.31.172:80

94.176.234.118:443

191.182.6.118:80

111.67.12.221:8080

91.219.169.180:80

70.32.115.157:8080

45.33.77.42:8080

177.73.0.98:443

219.92.8.17:8080

212.174.55.22:443

189.2.177.210:443

46.28.111.142:7080

37.52.87.0:80

rsa_pubkey.plain

Targets

    • Target

      cb0aac80ab9c3eb07a99448d7eb898a30ddae2f13809e93d088d0ec57581fff1

    • Size

      496KB

    • MD5

      c3d0753aa18ae395ae312bedf3390f90

    • SHA1

      94d86e9c0bc3e28ac18625df07484ab13c44338e

    • SHA256

      cb0aac80ab9c3eb07a99448d7eb898a30ddae2f13809e93d088d0ec57581fff1

    • SHA512

      d7d2bcca9ba04913f802c7f75b2314bfb0ed4e2250b08b4e5fbdd8e9ec673a260ca31d4a0953f92dfa20871ef1ecee0be4f17084e7b6a792f792edf54710c2c7

    • SSDEEP

      6144:/pe63b5W9ALT/5+VxdMEW4UCXSGFHSrV2D6kWPzn8ROYrh7QIWU9iQGTuF4:Re6LsScVnMX4UCBFHFD6kWPz8RHQul2

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

MITRE ATT&CK Matrix

Tasks